STIGQter: STIG Summary: Cisco NX OS Switch L2S Security Technical Implementation Guide Version: 3 Release: 4 Benchmark Date: 01 Jul 2026:

The Cisco switch must have all user-facing or untrusted ports configured as access switch ports.

DISA Rule

SV-220694r991951_rule

Vulnerability Number

V-220694

Group Title

SRG-NET-000512-L2S-000011

Rule Version

CISC-L2-000250

Severity

CAT II

CCI(s)

CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Weight

Fix Recommendation

Disable trunking on all user-facing or untrusted switch ports.

SW1(config)# int e1/3-128
SW1(config-if)# switchport mode access
SW1(config-if)# end

Check Contents

Review the switch configurations and examine all user-facing or untrusted switchports. The example below depicts both access and trunk ports.

interface Ethernet1/1
switchport
switchport mode trunk
switchport trunk allowed vlan 1-998,1000-4094

interface Ethernet1/2
switchport
switchport mode trunk
switchport trunk allowed vlan 2-998,1000-4094

interface Ethernet1/3

interface Ethernet1/4
switchport access vlan 10

Note: Switchport mode access is the default and hence will not be shown in the configuration.

If any of the user-facing switch ports are configured as a trunk, this is a finding.

The Cisco switch must have all user-facing or untrusted ports configured as access switch ports.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key